Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 281–300 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 29 Apr 2026, 15:13 WIB

CVE-2026-42513

Authentication Bypass Vulnerability in e-Sushrut HMIS

This vulnerability exists in e-Sushrut due to improper authentication logic that relies on client-side response parameters to determine authentication status. A remote attacker could exploit this vulnerability by intercepting and modifying the server response. Successful exploitation of this vulnerability could allo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T08:13:23.151Z. Updated 2026-04-29T12:27:26.457Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:27 WIB

Official record

MedPublished 29 Apr 2026, 15:08 WIB

CVE-2025-10503

Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server

The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper output encoding. This allows for the injection of malicious JavaScript payloads, enabling reflected cross-site scripting. An attacker can leverage this vulnerability to redirect the us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 281 to 300 of 5813.First page Next page

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T08:08:37.335Z. Updated 2026-04-29T12:28:52.278Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:28 WIB

Official record

MedPublished 29 Apr 2026, 14:51 WIB

CVE-2026-42412

WordPress WP User Frontend plugin <= 4.3.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP User Frontend: from n/a through 4.3.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T07:51:40.734Z. Updated 2026-04-29T13:34:49.632Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 20:34 WIB

Official record

HighPublished 29 Apr 2026, 14:27 WIB

CVE-2026-42377

WordPress SureForms Pro plugin <= 2.8.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brainstorm Force SureForms Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms Pro: from n/a through 2.8.0.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T07:27:22.305Z. Updated 2026-04-29T13:16:17.514Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 20:16 WIB

Official record

MedPublished 29 Apr 2026, 11:46 WIB

CVE-2026-21023

CVE-2026-21023

Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify the installation restriction of specific application.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T04:46:46.051Z. Updated 2026-04-29T12:41:12.467Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:41 WIB

Official record

HighPublished 29 Apr 2026, 10:50 WIB

CVE-2026-35155

CVE-2026-35155

Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected Credentials vulnerability. A race condition vulnerability exists that could allow an authenticated low‑privileged attacker to gain elevated access.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T03:50:56.690Z. Updated 2026-04-30T03:55:52.264Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated30 Apr 2026, 10:55 WIB

Official record

MedPublished 29 Apr 2026, 10:39 WIB

CVE-2026-23773

CVE-2026-23773

Dell Disk Library for Mainframe, version(s) DLm 8700/2700 contain(s) a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T03:39:25.139Z. Updated 2026-04-29T13:55:05.699Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 20:55 WIB

Official record

HighPublished 29 Apr 2026, 09:55 WIB

CVE-2026-42615

CVE-2026-42615

GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets('%3Cscript substring.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T02:55:53.171Z. Updated 2026-04-29T13:14:40.068Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 20:14 WIB

Official record

UnscoredPublished 29 Apr 2026, 07:00 WIB

CVE-2025-50328

CVE-2025-50328

A vulnerability in B1 Free Archiver v1.5.86 allows files extracted from downloaded archives to bypass Windows Mark of the Web (MotW) protections. When an archive is downloaded from the internet and extracted using B1 Free Archiver, the software fails to propagate the 'Zone.Identifier' alternate data stream to the extra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T00:00:00.000Z. Updated 2026-04-30T13:20:30.225Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Apr 2026, 20:20 WIB

Official record

UnscoredPublished 29 Apr 2026, 07:00 WIB

CVE-2025-56534

CVE-2025-56534

A cross-site scripting (XSS) vulnerability in the custom authenticator driver of opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T00:00:00.000Z. Updated 2026-04-29T16:24:39.575Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Apr 2026, 23:24 WIB

Official record

UnscoredPublished 29 Apr 2026, 07:00 WIB

CVE-2025-56535

CVE-2025-56535

A cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the zone attribute parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T00:00:00.000Z. Updated 2026-04-29T16:25:48.166Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Apr 2026, 23:25 WIB

Official record

UnscoredPublished 29 Apr 2026, 07:00 WIB

CVE-2025-56536

CVE-2025-56536

A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the user information parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T00:00:00.000Z. Updated 2026-04-29T16:23:42.067Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Apr 2026, 23:23 WIB

Official record

UnscoredPublished 29 Apr 2026, 07:00 WIB

CVE-2025-56537

CVE-2025-56537

A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 and fixed in v.7.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the virtual network template parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T00:00:00.000Z. Updated 2026-04-29T16:21:27.264Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Apr 2026, 23:21 WIB

Official record

UnscoredPublished 29 Apr 2026, 07:00 WIB

CVE-2026-30769

CVE-2026-30769

An issue in the TVicPort64.sys component of EnTech Taiwan TVicPort Product v4.0, File v5.2.1.0 allows attackers to escalate privileges via sending crafted IOCTL 0x80002008 requests.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T00:00:00.000Z. Updated 2026-04-29T20:04:26.509Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Apr 2026, 03:04 WIB

Official record

UnscoredPublished 29 Apr 2026, 07:00 WIB

CVE-2026-36837

CVE-2026-36837

TOTOLINK A3002RU V3 <= V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the hostname parameter in the formMapDelDevice function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T00:00:00.000Z. Updated 2026-04-29T15:14:43.274Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Apr 2026, 22:14 WIB

Official record

UnscoredPublished 29 Apr 2026, 07:00 WIB

CVE-2026-36841

CVE-2026-36841

TOTOLINK N200RE V5 was discovered to contain a command injection vulnerability via the macstr and bandstr parameters in the formMapDelDevice function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T00:00:00.000Z. Updated 2026-04-29T20:28:26.618Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Apr 2026, 03:28 WIB

Official record

UnscoredPublished 29 Apr 2026, 07:00 WIB

CVE-2026-37555

CVE-2026-37555

An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.fra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T00:00:00.000Z. Updated 2026-07-15T02:48:46.534Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jul 2026, 09:48 WIB

Official record

UnscoredPublished 29 Apr 2026, 07:00 WIB

CVE-2026-38991

CVE-2026-38991

Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially crafted filename bypasses an extension filter. This allows an authenticated attacker to rename arbitrary files with the .php file extension enabling arbitrary code to be executed on the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T00:00:00.000Z. Updated 2026-04-29T20:23:41.211Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Apr 2026, 03:23 WIB

Official record

UnscoredPublished 29 Apr 2026, 07:00 WIB

CVE-2026-38992

CVE-2026-38992

Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T00:00:00.000Z. Updated 2026-04-30T15:22:49.472Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Apr 2026, 22:22 WIB

Official record

UnscoredPublished 29 Apr 2026, 07:00 WIB

CVE-2026-38993

CVE-2026-38993

Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T00:00:00.000Z. Updated 2026-07-15T01:02:20.581Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:02 WIB

Official record